FTC Order Will Require Blackbaud to Delete Unnecessary Data, Boost Safeguards to Settle Charges its Lax Security Practices Led to Data Breach

The FTC filed a complaint against Blackbaud for lax security and data retention practices that enabled a 2020 breach exposing unencrypted sensitive data of millions, after which the company paid a 24 Bitcoin ransom and delayed full disclosure to customers. The proposed order requires Blackbaud to implement a comprehensive security program, enforce a data retention and deletion schedule, avoid misrepresentations about security, and notify the FTC of future reportable breaches.